Citizenship in a Republic - <AUTHOR> http://en.wikipedia.org/wiki/Citizenship_in_a_Republic

<comment><USER2> EDIT: the title of this post has now been changed, to the extent that it loses its entire relevance to HN. It was previously something along the lines of "After a year reading HN, this quote reminds me of the people here"

\---

I'm deeply skeptical of any attempts to romanticise "doing a startup".

 _"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"_

Running a startup is hard work. No-one disputes that. But if you are in the position to run your own startup you are _incredibly lucky_. There are a lot of people out there that might be far better entrepreneurs than you, but because they weren't born into a situation that gave them a good education and the ability to take a risk, they never will.

Running a startup is stressful, but don't try to pretend that there aren't enormous upsides. You can do whatever you want, you can work with whomever you want. The industry _celebrates failure_ \- think about that for a second. You can try your best, fail miserably, and people will still say that you did a good job. How many other people in the world can do that? The guy earning minimum wage in his factory job, spending all his salary just to keep out of poverty- if he fails, he is fired, and he and his family are screwed. He is the person whose face is much more likely to be covered in actual dust and sweat and blood.

Being in this industry is a position of extreme privilege. Harping on about it as if it's a heavy burden to bear is utter nonsense and only helps the perception of "startup folk" as deeply out of tune with how the rest of the world works.

<comment><USER3> Oh yay, another post like this.

> Running a startup is hard work. No-one disputes that. But if you are in the > position to run your own startup you are incredibly lucky. There are a lot > of people out there that might be far better entrepreneurs than you, but > because they weren't born into a situation that gave them a good education > and the ability to take a risk, they never will.

Nobody is born into a situation that ~20 years later destine them to run a startup.

The type of person who takes charge of their life, also takes charge of their education, you cannot learn some of the skills it takes to be a self made person.

Risk appetite isn't something predetermined at birth, and it isn't learned from someones environment. You can develop the ability to take risk from surrounding yourself with successful people, just as easily as you develop it from having nothing left to lose, and realizing how much you've been overestimating your worst case scenarios.

> Running a startup is stressful, but don't try to pretend that there aren't > enormous upsides. You can do whatever you want, you can work with whomever > you want.

If what you want to do is work and focus on success, then you can do whatever you want, but there are plenty of moments where you will want to be doing something else. This is called self-discipline, its just like the discipline normal people are subjected to, if you ignore it, you lose your job, or your startup fails.

> How many other people in the world can do that?

Not as many as I would like. There are organizations like Kiva that aim to give those less fortunate an opportunity, and hopefully more pop up that make it even easier.

> The guy earning minimum wage in his factory job, spending all his salary > just to keep out of poverty- if he fails, he is fired, and he and his family > are screwed. He is the person whose face is much more likely to be covered > in actual dust and sweat and blood.

He can also get another factory job. Try failing a startup and just starting another, its going to be a lot harder than pounding the pavement and submitting resumes.

> Being in this industry is a position of extreme privilege. Harping on about > it as if it's a heavy burden to bear is utter nonsense and only helps the > perception of "startup folk" as deeply out of tune with how the rest of the > world works.

Anyone harping on it as a burden has the wrong attitude, and frankly I would be surprised if they lasted.

It is definitely not extreme privilege. These companies don't just start themselves and adopt whoever has the winning ticket. You have to have a good idea, and you have to be willing to act on it.

Many people have good ideas, and could grow a successful business out of their idea, but they have the wrong ideas about what is stopping them, so they never try. These people come from the same communities as any startup founder. The difference is a founder dares to challenge the beliefs that have been crammed down their throat, even if everyone around them insists its a bad idea.

<comment><USER4> All success is largely dependent on luck and culture. Where you are born, who your parents are, etc. Being in a position where you can take charge of your life is also largely dependent on the same luck and culture. I think this is what the parent is stressing.

<comment><USER3> > All success is largely dependent on luck and culture.

All success?

> Where you are born, who your parents are, etc.

This is only true up to a certain point. Obviously if you were born in the ocean and your parents are dolphins, you're going to have a hard time starting and running a coal mine.

Every time I hear someone talking about the role luck has with success, they are usually giving examples of how _bad luck_ makes success impossible.

Nobody here insisting that there is more to success than luck is trying to say something like "people in North Korea just need to tough it out". We're talking about the millions of people who have every opportunity to be successful, but don't do so, because they are unwilling to commit to what they perceive to be too risky, and too difficult. The attitude you and the parent stress is the attitude that keeps so many people lower than they should be.

Successful people usually are not successful on their first try either, how many times do they have to fail before you would attribute their success to their efforts and not that "well, 3,847th time is always a charm"?

<comment><USER4> Yup, all success. It's a combination of luck and hard work. Rarely are there success stories that involve either no luck at all or no hard work at all. But the work almost always follows the luck, i.e. if you are born an inner city black child in say the poorest parts of Baltimore, no amount of hard work may make a difference. And it may in fact be that being born into that scenario renders you unable to see that hard work enables success because your culture doesn't teach you.

I'm not saying that successful people were only successful because of luck. But they were successful because they were born in correct circumstances and cultures that allowed them to become successful.

I don't disagree that lots of people have every opportunity to be successful and choose not to. But I'm talking about the ones who are actually successful and how luck and circumstances are very important.

</comment></comment></comment></comment></comment><comment><USER5> Original title: "After a year of reading HN, this is how I view the successful entrepreneur"

New title: "Citizenship in a Republic"

<comment><AUTHOR> Huh. It really makes no sense why I posted this after the title change. What gives?

</comment></comment><comment><USER6> Thanks for sharing this link. As it related to HN, I think you have to applaud all of the people who go out on a limb and share their work-in-progress side project, new startup, or anything else that they've created---knowing that half of the community will "point out how the strong man stumbles, or where the doer of deeds could have done them better."

I still am a relative beginner to the space, and I do find it frustrating when people dismissively point out such "obvious" problems with our project, or things we should be doing, but I think it comes with the territory.

<comment><AUTHOR> Yeah! He even refers to the "critics" as such, those on the outside of the arena.

</comment></comment><comment><AUTHOR> It appears a lot of people talk about what it takes to make a successful startup and the like. Reading through this today just reminded me of the fight many startup entrepreneurs take every day.</comment>


Bloating, via Base64 images - <AUTHOR> https://csswizardry.com/2017/02/base64-encoding-and-performance/ <comment><USER2> The old adage was that "total page weight" and "number of assets" were the big drivers of slow web sites.

HTTP/2 should make "number of assets" less of a problem, since it no longer drives multiple connections, assuming all are from the same site/domain.

Edit: Bloated JS and parse time might be the right contender to replace "number of assets" if you want to point to the top 2 current issues.

</comment><comment><USER3> It also prevents you from using immutable caching.</comment>


How to Android without Google - <AUTHOR> https://bytemybits.gitlab.io/post/2018-05-23-how-to-android-without-google-easy-way/ <comment><USER2> _Enable Google device registration_ _Enable Google Cloud Messaging_

I run Android without Google. I bought a new phone, and when I powered it up, it tried to get me to "sign into Google". I declined. I downloaded F-Droid. Then I disabled every Google thing that could be disabled.After that, all apps came from F-Droid. Mail is via K-9 mail and an IMAP server. Browsing is Fennec F-Droid, which is Firefox minus some unwanted Mozilla-calling stuff. Mapping is ZANavi. Location provider is Mozilla. Works fine.

<comment><USER3> Last time I looked at it, maybe a couple of years ago, the parent's approach was not nearly sufficient if you don't want your phone communicating with Google. There was so much, including things baked into Android, that it would have been a full time job to identify and find solutions to everything. The only hope was another OS (including Android forks/ROMs), and none of those available at the time seemed sufficient secure - many didn't focus on security, didn't know what they were doing, or lacked resources to complete the job - or capabilities.

As one simple issue, I'm pretty sure Android uses Google's DNS and that is hard to change.

Sorry to be vague; I wish I had more details but don't have time to look them up right now. The basic message is: It's not sufficient, depending on your goals. to rely on settings in the GUI and to avoid Google applications.

<comment><USER4> I agree with the general feeling, but for the DNS issue specifically you can use iptables' DNAT if you're root. It is unlikely that Google went as far as bypassing iptables just to use their DNS.

Example usage:

        iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination 18.104.22.168
        iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination 188.8.131.52

</comment></comment></comment><comment><USER5> This isn't really Android without Google - if you do this, you're still using Google's services and piping data through them. It's kind of like switching from Chrome to Firefox to open Gmail.

<comment><USER6> There is android without google. My device uses 0 google services.

<comment><USER7> interesting. what do you use to accomplish that?

<comment><USER8> Don't install Google services or microg, and don't use apps which require any of that crap.

</comment></comment></comment></comment><comment><USER9> The real Android without Google is CopperheadOS[1], which is also ahead of Google in terms of security (not behind, like LineageOS).

[1] [https://copperhead.co/](https://copperhead.co/)

<comment><USER10> Why is Lineage behind?

<comment><USER9> When a security patch for Android becomes available, it takes a lot of time until it gets ported to the LineageOS build targeting your device. If it ever happens at all.

<comment><USER11> Also it's worth remembering that LineageOS can't patch the driver blobs (which are a source of a large number of security issues). As a result, if you don't run it on a maintained platform (e.g. Google Pixel phones), you're still behind in security.

<comment><USER12> For Fairphone 2 you can manually update that quite easily.

</comment></comment></comment></comment></comment><comment><USER13> I recently switch to a Sony Xperia X and I'm running AOSP built from source. If you just need a browser and want to make phone calls this is an OK solution.

[https://developer.sony.com/develop/open- devices/](https://developer.sony.com/develop/open-devices/)

</comment><comment><USER14> Unfortunately my phone isn't supported and I don't know how to build LineageOS for it, so I'm stuck with Google and also some other spyware that straight up sends contacts and SMS to servers in either China or US. Guess I should try and sue Alcatel under GDPR (but given they're owned by TCL, which is Chinese, I don't think it'll help).

<comment><USER15> Well, as long as it doesn't have a locked bootloader (I presume it doesn't), you should theoretically be able to get somewhere with it.

Rebuilding Android surely isn't that difficult (it's been on my todo list for some time, I've just never gotten around to it due to insufficient RAM).

<comment><USER16> Sadly for most devices it is impossible as many OEMs do not release kernel and firmware. Yes it may be a open source violation but try telling this to any OEMs. Search in XDA and you will see one of the largest manufacturer Xiaomi does not release sources. If you have MediaTek SoC forget it.

<comment><USER17> Mediatek sources are out there, along with full datasheets, desige guides, schematics, PCB layouts, etc. They're just not released "officially", but that doesn't mean they don't publicly exist.

</comment></comment></comment></comment><comment><USER18> LineageOS is no longer the CyanogenMod it once was. Where CM received regular updates and supported a plethora of devices, LOS has been dropping devices and doesn't do Oreo. My Galaxy S7 is no longer supported by LOS for absolutely no valid reason: [https://lineageos.org/Changelog-18/](https://lineageos.org/Changelog-18/)

> Removed 14.1 devices > Samsung Galaxy S7 (herolte) and S7 Edge (hero2lte) > due to licensing issues of the device trees

<comment><USER19> > doesn't do Oreo

Well I call bullshit:

[https://www.lineageos.org/Changelog-16/](https://www.lineageos.org/Changelog-16/)

As for why the device was dropped, go ask the maintainer. They're probably volunteers and it might be that one of them just stopped having time to do that. I don't think they're actually paid for porting LOS.

<comment><USER18> Somehow this sort of thing never happened to a recent device like the S7 back in the days of CM, before it became Cyanogen Inc. Between the death of Cyanogen Inc. and the birth of LOS a crucial ingredient appears to have been lost, leaving the project as a whole less vital that it was before.

<comment><USER20> Overall interest in the ROM and android modding community has been decreasing. CM appeared right when android really started gaining traction and the modding community prospered. That was when phones were seen as the cool new tech with all these interesting features. Nowadays most people don't care what is in their phones as long as it runs the apps they want, takes decent pictures, and lasts for a decent part of the day. It also doesn't help that nowadays app developers have started intentionally crippling apps when a custom ROM is detected.

Because of this most people don't contribute to android ROM projects anymore. For a lot of people it just isn't worth the effort those that do care tend to keep up with new tech and buy the latest and greatest tech so they aren't maintaining old devices as much anymore unless they were major hits or a personal preference of the maintainer.

As for why a lot of features have disappeared, through the whole process of surviving the Cyanogen Inc. issues, it took everything the community had to keep basic android supported let alone all the extra features considering how many devices they support. Now that Treble has been deployed, this shouldn't be so much of an issue but maintaining so many old devices that have long been deprecated isn't easy.

Also, as for why the S7 is no longer maintained, apparently there was some bs issue with the software license on the S7 binaries.

</comment></comment></comment></comment><comment><USER21> I don't even run microg. Here WeGo is great for maps. Firefox is great as a browser, and has nice things like playing youtube in background (after adding an extension) or ublock. Slack works (without notifications), Spotify, Netflix, Authy, Signal... Many things have PWAs that work because they are platform-independent. For installing things there's F-Droid or APKUpdater. You could even use Facebook Messenger without Google and still get notifications. My battery is great and Android

<comment><USER22> OSMand for maps is even better than google maps, in terms of map correctness and navigation options.

<comment><USER23> I just installed OSMand to try it out, and it didn't have the street I live on. It also didn't have my place of work on it, although it did have that street at least.

Seems worse than Google maps to me.

<comment><USER24> Did you also download the map for your area?

<comment><USER23> I downloaded the maps for my state. Are there local maps that I would need to download as well?

<comment><USER21> Open Street Maps have much more users (and thus better ground coverage) in Europe, e.g. Germany. I think that's why the experience may be diametrically different for different people.

</comment></comment></comment></comment></comment></comment><comment><USER25> "De-Googling my phone" by Martin Pitt was also a pretty interesting related read: [https://piware.de/post/2018-05-01-android- degoogle/](https://piware.de/post/2018-05-01-android-degoogle/)

</comment><comment><USER22> it is still impossible. the step #1 there, "install lineageOS" translates to "install a bunch of binaries blobs that include kernel drivers and firmwares that were signed by the OEM and google", so no, you are still not free from google code there.

<comment><USER26> Is Replikant still a thing?

</comment></comment><comment><USER27> It is pretty interesting that people outside China are trying hard to get rid of Google on Android. Whereas people buying phones in China are getting Android without Google by default and trying hard to install Google play services (those who travel or live oversea).

<comment><USER28> Not that interesting TBH. In Germany people are trying to get on Facebook/Instagram/LinkedIn right now, when people in the US are trying to escape them. It's simply a new thing marketed there.

<comment><USER29> Germany doesn't have access to FB/Instagram/LinkedIn?

</comment></comment></comment><comment><USER30> Bummer that they don't support Nokia (yet). I have a first-gen 6, it's a fine phone, but I've been thinking that my next phone will be an iPhone because I'm tired of Google and their invasive tactics. I don't mind advertising and understand the business model that uses it, but I am wholly opposed to targeted advertising that tracks my browsing habits and which sites I visit.

</comment><comment><USER16> In summary, look at [https://download.lineageos.org/](https://download.lineageos.org/) before buying if you want support from LOS. Sadly many buy the bling phone or cheap from far-east that is riddled with bloatware/spyware.

</comment><comment><USER31> As an Android developer I'm biased, but it's important to remember that there literally would be no Android if it weren't for Google. Custom ROMs have lagged behind Google factory images in every way for years now, and they aren't anywhere near as reliable as a customized AOSP image. On a separate note, there's no substitute for Google Maps, and there never will be.

<comment><USER32> There's tons of substitutes for Google Maps:

[https://f-droid.org/app/net.osmand.plus](https://f-droid.org/app/net.osmand.plus)

[https://f-droid.org/app/com.github.axet.maps](https://f-droid.org/app/com.github.axet.maps)

[https://f-droid.org/app/com.junjunguo.pocketmaps](https://f-droid.org/app/com.junjunguo.pocketmaps)

[https://f-droid.org/app/com.zoffcc.applications.zanavi](https://f-droid.org/app/com.zoffcc.applications.zanavi)

Either specify why you think Google Maps is so irreplacable or don't make such a blanket statement.

<comment><USER31> Those are all inferior substitutes. None of them can reroute you on the fly to avoid a major delay, and none of them provide real-time traffic updates on par with the updates provided by Google Maps. Being extremely popular gives it a huge advantage that none of the other map apps enjoy. There will never be a substitute because there is no logical incentive for anyone to use the inferior map apps, and without a massive increase in users they'll perpetually remain less accurate. How many people are willing to risk sitting in traffic unnecessarily to prove some point about not relying on Google technology?

</comment></comment></comment><comment><USER33> I'm considering the Essential Phone for my next phone and just putting Lineage OS or something on it. Not sure of another phone that I can get for that price range (under $500) that is unlocked and not bloatware filled. Definitely going to be reading a number of articles like these. Though I might try not installing the Google* apps on it period.

<comment><USER34> Essential died, I'd look at Android One devices like the Nokia 6 or Xiaomi Mi A1.

<comment><USER35> They're not dead yet. Sure, they stopped working on their next phone and are searching for a buyer, but they also just pushed out a new Android P beta for the PH-1.

</comment></comment></comment><comment><USER36> I have made a habit to de-americanize my products and went with a Xiaomi phone (the Mi Mix 2) and installed LOS on it.

The only thing I am really missing is Google Maps and its precise, actual traffic augmented, predictions.

I've tried Waze, Bing and OSM, but there is always something missing.

</comment><comment><USER37> Android is just the base. Smart-phones run pretty much custom firmware. You could get a "flagship" smarthone a couple of years old, basically for free, and the hardware would still be very good, but good luck upgrading to latest Android version.

</comment><comment><USER38> When I last did something like this, I reset to the original OS because of only one other thing I encountered - proprietary software like for e.g. Samsung S-Pen would not work. Unless I missed something?

</comment><comment><USER39> mostly no Gapps use open apps like f-droid as a source which has a lot of rules and fairly transparent. there are some shady app markets out there though.

</comment><comment><USER40> Xiaomi?</comment>


Ask HN: Why in the world hasn't this talk gone viral on YouTube? - <AUTHOR>

Lawrence Lessig at SCALE 12x<p>https://www.youtube.com/watch?v=D3O1MC1AqvM <comment><USER2> 1) Its long.

2) Its technical/legal.

3) I'm 19 minutes in and i'm still not sure when we're going to get to an actual argument/thesis/point that he wants to emphasize in this presentation...

4) He's talking to a bunch of yes men/preaching to the choir (by which i mean, he's not persuading, he's putting out an opinion to a bunch of people who already hold said opinion and who lap it up and laugh on cue like congress claps on cue during official speeches...

5) It has the word Linux associated with it.

<comment><USER3> > It has the word Linux associated with it. YES!

</comment></comment><comment><USER4> Because there is no shortage of anti-copyright activists right now. It's an old issue, and this video offers nothing new. It doesn't even present the info in a nice, quick, easily-digestible way (which is pretty important for something to go viral). His jokes just make it look like a video made for people who already agree with him.

</comment><comment><AUTHOR> After reflecting on this a bit, I think the biggest problem is that the point of the whole talk wasn't brought up until the end. Who knew this was actually about Campaign Finance Reform before they stopped watching?</comment>


Are there any tools to add push notifications in a saas web application? - <AUTHOR> Not just browser push notification. But also in-site notification something similar to facebook notification icon. <comment><USER2> Can you explain use case further</comment>


Social login buttons aren't worth it - <AUTHOR> http://blog.mailchimp.com/social-login-buttons-arent-worth-it/

<comment><USER2> On a tangentially related note, developers, please remember that not everybody in the universe has a Twitter account, or wants one. If you have some cool product and I _must_ sign in with FB/Twitter, straight to the close tab button I go and I'm not looking back.

<comment><USER3> When Spotify launched in the US, they disabled signups through their in-house authentication system and required that new accounts be created through the Facebook login. I never quite understood this, since I have a strong aversion to paying actual money for anything associated with my facebook account.. Thankfully they kept the old login system around for existing users (and they've since re-enabled sign-ups through it.)

<comment><USER4> They were heavily pushing the social streaming aspect, and admitted to as much. Letting other people know who you are listening to is a longstanding tradition, and worth good money to Spotify (who never raked it in to begin with).

<comment><USER3> I get that, but between the opt-out popups trying to trick you into broadcasting stuff on facebook and disabling signups for the old login system it got to be a bit much.

</comment></comment></comment></comment><comment><USER5> I agree with the conclusion, but the even more wildly actionable information is that you can decrease CS costs and increase customer happiness by using copywriting better than "That email and password do not match our records." (Also, as a product owner with an engineering background, I have to come down on the "In this case, prefer UX over security" side of the debate, since there are numerous other options for divining existence of an account/email address and refusing to tell the account owner that gets you no marginal security benefit but does frustrate their use of your system.)

<comment><USER6> The thing I find pretty hilarious (sad?) is that many sites that give you the generic "username or password is wrong" message are perfectly happy to tell you that a username is in use if you try to sign up for a new account (geez, I guess they sort of have to!).

<comment><USER7> Maybe it should be "Username or password in use"

<comment><USER4> The sad thing about that is that there have been actual applications with actual users that require unique passwords.

<comment><USER8> I was wondering recently if someone had ever done this. Do you have any examples/links?

<comment><USER4> TDWTF has several anecdotes. Try this, for one: <http://thedailywtf.com/Articles/Uniquely_Secure.aspx>

<comment><USER8> Thanks, that's hilarious. I can see someone thinking that unique passwords are a way to make sure that people aren't overusing common passwords - and not realizing that you are implicitly letting everyone know what passwords are currently in use.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The title is total linkbait -- once you read through the article, it becomes clear that all the author is claiming is that social login buttons weren't the right choice for Mailchimp. They might be the right choice for others though: "Sometimes it makes a lot of sense, and other times it's just not worth the trade-offs".

Although Mailchimp has a lot of users, it doesn't make sense to generalize conclusions from one SaaS business to the whole web. A private SaaS dashboard is a different use case from most consumer websites, where the goal of logging in with Twitter or Facebook is generally to attach your public identity to your posts or profile on the site, _not_ merely to expedite login. And frankly, a private dashboard is a very strange place to add social login buttons in the first place. Although the "what login did I use?" issue comes up on consumer websites that make good use of social auth, it does so less often, because if you connected a third-party account to one of these sites, you did it for a reason and are more likely to remember.

<comment><USER10> People seemed to miss this article when it was posted here when it was published. Surprised at some of the comments; they seemed to only read the headline before commenting as well.

Like I said then, the social buttons didn't work for MailChimp because they implemented them after most users already had email logins. The article dismisses a concept that is integral to onboarding users at _the beginning_ of your service. When everyone has been using their email login for years, why would they switch? I disagree with some of the people here saying these types wouldn't use a Facebook login. _Lots_ of people use MailChimp; lots of people that have no issue using a Facebook login (and don't understand the risk in doing so).

This is a case of coming to the wrong conclusion with the wrong data.

</comment></comment><comment><USER11> > _What if Facebook or Twitter were hacked? Your social profile would be at > risk (the sun would still rise tomorrow), but so would any other account on > other services that are connected. That's a little scary. Yes, Facebook and > Twitter are good at security, but nobody, NOBODY, is perfect. Social login > buttons delegate control of your users' credentials to another service, > rather than ensuring security yourself._

Well, nobody is perfect, but some are better than others [0]. Security is hard. In my case, I'd trust services like Twitter and Facebook more than myself right now (they have tons of good engineers and much more to lose in case of a security breach). Like many other things, this is a trade-off.

[0] - <http://lesswrong.com/lw/mm/the_fallacy_of_gray/>

<comment><USER12> This is doubly true when it comes to Mozilla's Persona. I implicitly trust my email provider more than any other site's login system (at least, the ones that email password resets), so why not delegate to that all the time instead of insisting on a different username and password?

<comment><USER13> That's why I love Persona, I wish it were more widely used (and by more big names).

I actually got a little apprehensive about the security of the bridge, and wrote my own IdP you can use for your own domain: <https://www.persowna.net/>

</comment></comment></comment><comment><USER14> Man, I'm glad to read some anti-social login stuff, as I personally do not like everyone depending on FB. I've read articles on tech crunch which say to ONLY have facebook logins for MVP, which made me cringe.

However, the key thing to realize here is that 3% of _mailchimp's_ users use the social login buttons. That doesn't translate to 3% of _your_ users. One app I work on is a social app for music fans. Most of our users hit the facebook button. It's also mobile, so that might have something to do with it as well (people might not want to type on mobile devices as much)

Takeaway: you need your own stats.

<comment><USER15> Exactly. Mailchimp has a very specific userbase, probably much closer to Basecamp than Facebook. If you're in that camp (serving ads, tracking biz finances, time tracking for freelancers, etc.) then Facebook/Twitter login may send the wrong message, that you're fluff. But, if you _are_ fluff (music sharing, video game discussion, daily joke email) then social login could be very compelling to your potential users.

</comment></comment><comment><USER6> > Social login buttons delegate control of your users' credentials to another > service, rather than ensuring security yourself.

It is basically guaranteed that both Facebook and Twitter logins are more secure than almost any website that might offer one of their login buttons. How many websites have dedicated security engineers? Does mailchimp.com? I doubt it (but I'd be impressed if they do).

The other arguments are pretty reasonable; of course if you don't want to put another brand right in the middle of your login page, a social login button might not be for you. But security is almost an anti-concern: it's probably a win for your users in that respect.

<comment><USER16> It's certainly possible that they may be more secure than a lot of smaller sites, although that's not guaranteed - social media sites are fairly likely to be more interested in agility than robust security.

What is pretty much guaranteed is that there's more people trying to hack Facebook/Twitter security than most smaller sites.

<comment><USER11> > _What is pretty much guaranteed is that there's more people trying to hack > Facebook/Twitter security than most smaller sites._

That, and the fact that they're still around means exactly that it is guaranteed they are more secure than most of the smaller sites. Being a big and valuable target to hit, they can only adapt or die.

<comment><USER16> Not really. That would only be true if the hackers didn't occasionally have success, like

[https://securityledger.com/that-facebook-account-hijack- vuln...](https://securityledger.com/that-facebook-account-hijack- vulnerability-is-still-dangerous-heres-why/)

or

[http://www.digitaltrends.com/social-media/twitter-was- vulner...](http://www.digitaltrends.com/social-media/twitter-was-vulnerable- to-password-theft/)

</comment></comment></comment></comment><comment><USER17> For services I want to quickly try out once, if you just need a quick way to authenticate, I will look for a Facebook login button and generally leave the site if it doesn't have one.

Of course you also can't ask for any odd permissions either!

</comment><comment><USER18> Did they consider that people tend to not use their facebook account for work accounts?

Anything relating to my job, I use my work email with a password. Anything personal, if I have the option, I use Facebook and don't let it to post to anyone but me.

<comment><USER19> Perhaps Google login would be better for them then - it would work especially well for companies that use Google Apps internally.

</comment></comment><comment><USER20> Would using Mozilla's Persona instead of social login be a good alternative?

<comment><USER21> I was thinking this the entire time I was reading the article, and was disappointed not to see it mentioned. Persona was invented precisely to solve this problem.

Hopefully it will gain traction...

</comment></comment><comment><USER22> > _If you're using Twitter and Facebook for signup too you've got a bigger > problem. A user's credentials are then bound to another account on another > service that could be canceled at any time, breaking access to your app > without the user knowing_

I'd never really thought about this. What do people suggest doing to handle this sort of use case?

<comment><USER23> I dislike Twitter login for this reason, you can't key off a user's email address.

</comment></comment><comment><USER7> What effect would having "Stay logged in" checked by default on the number of failed login attempts?

</comment><comment><USER24> While I agree (mostly) with the conclusions of the article, the reason social login buttons exist, is that people want easy access to services without having to fill out a bunch of stuff. Services like social login, persona and other open id are a step in the right direction for solving that, but I think it would be best if it were implemented in the browser. Specify how you'd like to identify yourself to the web (or specific pages) and just add 1-click confirmations. Can't believe I'm saying this, but Microsoft's InfoCard would have been perfect for this :)

</comment><comment><USER25> Previous discussion from a couple of months ago: <https://news.ycombinator.com/item?id=4603204>

</comment><comment><USER26> It should be noted that MailChimp is huge. I have no figures, but I'm guessing they have millions of users. This means that problems that affect 0.1% of their userbase still represent a nominally large number of users. They don't have problems like user acquisition and brand recognition.

For me, adding 'signup with Facebook' has increased the number of registrations. I'll worry about the effect on failed logins when it proves to be a problem.

</comment><comment><USER27> Even though I very much prefer having an FB login, and think that is much more secure than having manual login (and thus having to remember passwords, which most people will "solve" by the having the same password, which is really insecure),for the love of god, keep your social logins down to 1-2 options, if you must have them. Please do not throw in Facebook, Twitter, GitHub, Google, LinkedIn, and the rest of the kitchen sink.

</comment><comment><USER28> > _"But after some further consideration, we decided that it was a false risk, > as the username reminder form already tells you if a username exists"_

The solution would be to close that hole, rather than opening the same hole somewhere else. For example, for the username reminder form, if the username can't be found for a given email address, then that can be conveyed to the user by sending them an email message.

<comment><USER29> Well, how do you work around the issue of the New User Registration form telling you that the username already exists?

I think it's better to assume usernames are publicly available information and atleast get your UX right for the Login Form.

<comment><USER28> Good point. There isn't much you can do about usernames, but if the site just uses email addresses as a login then you can protect that.

<comment><USER30> Looking at the MailChimp site, I don't understand how that would make much of a difference. Right now, you can enter emails into the "Forgot Username" field and eventually hit a good one, but then you need to crack the email account to get the username so that you can then stick that in the "Forgot Password" form. Eliminating usernames, you click the "Forgot Password" link and enter emails into the field until you hit a good one, giving you both the email and "username" right away.

</comment></comment></comment></comment><comment><USER31> I'll keep conveniently logging into a lot of services with social logins, thank you.

To me, there is especially the case of using a social login to sign up for just trying out a service, which I would not have done if it had meant going through the hassle of filling out a form or even validating en email.

</comment><comment><USER32> But telling the user that their username OR password is incorrect is good practice though right? If you were trying to break in to somebody's account, it would be better for the person breaking in to not know whether or not that account exists, is a typo etc.

<comment><USER33> Is it really "good practice"? It seems like cargo-cult security to me. Usernames are usually public anyway; refusing to reveal the existence of a user name as part of the login process but revealing it elsewhere in your application is pointless.

<comment><USER32> Take it to the extreme and think about banking. You wouldn't want to have a system where you confirm and deny the existence of accounts for somebody who's rotating through a brute force. SSH logins for instance do this.

<comment><USER34> But if usernames are released publicly in forums, google crawled pages etc, then an attacker already knows the existence of a subset of the accounts at least.

For example, somebody attacking HN can crawl pages such as this one and determine that 'skeletonjelly' is a valid HN user.

<comment><USER32> Sure, but I guess there's no one single security model that fits all situations. I guess that's what I meant by "best practice". Obviously internet banking usernames wouldn't be listed somewhere public

</comment></comment></comment></comment></comment><comment><USER35> <https://news.ycombinator.com/item?id=4603204>

From when this was previously discussed (originally published?)

</comment><comment><USER36> What happened with people who logged in with Facebook and Twitter?

</comment><comment><USER37> Depends on your target audience imo. For a consumer facing product, If a considerable size of your traffic is coming from facebook, it sure makes sense to have that option.</comment>


Dropbox says It Can Decrpyt Files If The Government Ask - <AUTHOR> http://www.businessinsider.com/dropbox-updates-security-terms-of-service-to-say-it-can-decrpyt-files-if-the-government-asks-it-to-2011-4 <comment><USER2> A number of things here are being said in misleading ways.

The title:

> DROPBOX: We'll Turn Your Files Over To The Government If They Ask Us To

No, they didn't say that. They said, "... Dropbox cooperates with United States law enforcement when it receives _valid legal process_ , ...." (emphasis mine) And that is quite a bit different from "ask". I imagine the Dropbox people know the difference; I would be pretty unhappy about this title, if I were one of them.

> ... shouldn't affect the average user unless they're doing something wrong.

As pointed out by HN'er sixtofour, the real issue here is not whether you are doing something wrong, but whether you are _accused_ of doing something wrong.

However, _I_ will point out that this change in the privacy policy, will, in fact, affect _no users at all_. Dropbox is simply pointing out that, being based in the U.S., they are of course required to obey U.S. law. They were required to do so, even before they pointed that out. Now they are being clear about this fact. Good for them, but it doesn't change what they are required to do.

Also, it's worth noting, that that ridiculous line about "unless they are doing something wrong" does not appear to come from Dropbox, but from the author of the article.

</comment><comment><USER3> "shouldn't affect the average user unless they're doing something wrong."

s/doing/accused of doing/

</comment><comment><USER4> The protip, then, is to create a 256 bit AES-encrypted sparseimage and store that (or several of them) on your Dropbox. So the government might be able to get hold of your sparseimages but Dropbox wouldn't be able to open them up.

</comment><comment><USER5> I suppose if you _really had_ to store something sensitive on Dropbox, you'd just TrueCrypt it first... Not really an issue then, no?</comment>


Should Surgeons Keep Score? - <AUTHOR> https://medium.com/backchannel/should-surgeons-keep-score-8b3f890a7d4c <comment><USER2> I'm astounded at the tenor of comments on this article, which I would expect to find at any site other than this one. Yes, measuring surgical outcome data and surgeon performance could lead to a variety of complications, perverse incentives, regulatory capture, etc. etc. All true.

But you know what's worse than that? Having no fucking information about anything. I'm in the process of trying to find a surgeon to help with an orthopedic procedure, and it is so incredibly frustrating that I have a thousand times as much information on which refrigerator I should buy, or which phone, than about something that will affect my life more intimately than any consumer product ever could.

And yes, of course I get that rating a commodity with a fixed function that is used by zillions of people is way more straightforward. But look, all of these apocalyptic scenarios about brain surgeons who only take trivial cases so they can have a better score on the leaderboard? I'm just not worried about it. At all. Because people are generally proud and want to do better. Because of the social and professional stigma that would come from such behavior. Because if you collect a rich dataset, you can account for most kinds of gaming, just as you can do for teacher outcomes, or every other damn thing.

But probably most of all because the current state of affairs is so abjectly wretched, and literally any effort at measurement and accountability would be better under every reasonable scenario.

<comment><USER3> Incase you find this useful:

Just lying in hospital bed here about 36 hours after 2nd revision on a THR first done in 1987. In the absence of clear public metrics I used the following approach to choose my most recent surgeon:

1\. Age/experience. I was looking for someone about 2/3 of their way thru career. Assuming experience and survival bias were positive indicators.

2\. I got a series of second opinions asking surgeons the direct question of whom they would get to operate on themselves if they needed the procedure done.

3\. I consulted a series of family doctors on their recommendations.

4\. I went with someone with a strong track record designing prostheses but also a large history of performing the particular procedure I was having.

There are always trade offs. My surgeon works long shifts and so I got them 12 hours into a shift on a friday, which had me a little nervous (fatigue wise).

So my main advice is don't be shy in getting a lot of opinions and advice. I will probably need another 2-3 revisions in my life time on this hip alone. So I thought it worth my while taking a thorough approach.

Still at the end of the day bad luck can always happen. Expect the best but be mentally prepared for the worst.

<comment><USER4> I believe #2 is key and have thought for years this could be the basis of a super-effective site. But not a lucrative one: a key problem is that any kind of monetization that would benefit the doctors doing the rating could pervert the results.

<comment><USER5> It could easily turn into "i scratch your back, you scratch mine" type of reviews. Even voting rings of doctors.

<comment><USER3> Definitely detected that in my travels - diabolical surgeon golfers ring :). I learnt to ask them what handicap they play off.

</comment></comment></comment></comment></comment><comment><USER6> My wife is a highly specialized surgeon, she does _one_ operation, and she does it around 600 times a year (Parathyroidectomy). An average endocrine surgeon might do 20 of these a year. She went through training as an endocrine surgeon and she tells me that the difference between the operation that they do at her center and what an average endocrine surgeon will do is like night and day. It is just not possible for surgeons with normal volumes to be able to achieve that level of skill. What helped them recently was the release of the medicare volume data [1]. This data is probably right now the only way to get an idea of how many operations of a particular type your surgeon does (not for all operations unfortunately, not unless you know a lot about billing codes and practices!).

[1] [http://blog.parathyroid.com/parathyroid-surgery- medicare/](http://blog.parathyroid.com/parathyroid-surgery-medicare/)

</comment><comment><USER7> Recently I had a major shoulder operation. I was shocked at how little information I had about who was a good surgeon. If I didn't have a family member who worked in the complaints department of the local big hospital, I would have had no way of knowing who was considered good or bad.

My surgeon told me that I had a 90% percent chance of success, and a 1% chance of nasty complications like nerve damage. The literature on the procedure said that typical success rates were 75% and the complications rate more like 5%. Was my surgeon particular good? Did I have a better shot because I was young and healthy? Or was my surgeon suffering from the Lake Wobegon affect and overconfidence? There was no way for me to know as a patient.

That said, naive score keeping could go very awry, for very obvious reasons that others in thread have mentioned.

Here is the system I would like to see. Tell me how this could get gamed:

Surgeons should be required to give official, written, probabilities to all potential patients. So for instance, a surgeon might say that there is a 90% chance that I can play football again, a 1% chance that my arm will end up worse than before the surgery, and a .01% chance of death.

Then surgeons should simply be measured against their own predictions. When I go to a surgeon, I should have access to that data. The surgeon has no incentive to be overly conservative with the probabilities - because then I will go to a surgeon who is more skilled, can predict better outcomes, and the track record to prove it. Nor does the surgeon have an incentive to be overly optimistic, because then they will get dinged for not scoring according to their own predictions. Nor does the surgeon have an incentive to turn away high-risk patients, they just need to state the risks accurately.

The patient wins because the patient can finally have the most accurate as possible information about the risks and benefits of a surgery, and can get multiple opinions, compare them, and have good data about which surgeons are reliable in their predictions.

<comment><USER5> Why ask for the doctor's opinion about the data, and not for the data itself?

And what's the punishment if the doctor's estimate is wrong? Or he/she is lying?

Doctors have enough shit on their plate, we simply need the access to the hospital data with the doctor names attached.

<comment><USER7> I ask for the doctor's official opinion/prediction about the probabilities for my own surgery. This must be the doctor's opinion because every person and every surgery is different. A doctor's job is to analyze each person's situation, and then use their experience, knowledge, and professional judgement to give the patient the doctor's best estimate of the benefits and risks of a given procedure. This is not "adding sh*t to their plate", this is formalizing a core job function of every doctor.

The patient would get the doctor's prediction track record directly from the hospital or a third party monitoring agency. That way the patient knows if the doctor is generally accurate in their predictions, or if they are consistently overconfident in their own abilities.

If a doctor was wrong once, they are wrong. If they are consistently wrong, then that shows up in their stats. Patients will no longer trust their predictions, and will seek other doctors. The doctor will have to really improve their prediction ability (a good thing) or else go out of business for lack of patients.

<comment><USER8> I don't see how this solves the problem of some doctors tackling harder/easier cases.

How do you distinguish two doctors with high prediction ability and low success rates (compared to the average for that procedure) if one is bad (and she knows it) and the other is tackling harder cases (and is actually one of the best in the field for cases with high probability of complications)?

Without input from other doctors (or simply using a lot of data where you can correlate hard procedures with other factors in the patient data) you'll never be able to distinguish the two doctors mentioned above.

<comment><USER7> " _How do you distinguish two doctors with high prediction ability and low success rates (compared to the average for that procedure)_ "

The doctor is never compared against the "average for that procedure" for exactly the reasons you give. The doctor is only compared against that doctor's own predictions.

So as a patient in need of a surgery, you would get opinions from 3-4 different surgeons, each one would offer their personal outcome probabilities. The patient gets access to that doctor's stats that score their actual track record against their own predictions. The patient should then choose the surgeon who gives the best odds but also has a track record of hitting their predictions.

A doctor who tackles hard cases should still have a good success rate against their own predictions. Such a doctor will just lower their predictions according to the riskiness of the case. If the doctor is good, such a doctor will still get business, because the skilled doctor will still offer better odds (odds that the patient can actually trust) than can be reliably offered by a less skilled doctor.

The one weakness of my system is that it does not give any sort of global score. There is still the problem of having to find 3 to 4 good surgeons to ask for an opinion in the first place. But at least once you have gotten to that point, you can have trustworthy predictions upon which to base your decisions.

<comment><USER9> Doctors in such a system may still have an incentive to over negatively predict the tough cases, and specifically by an amount greater than their peers.

The hope would be "send this tough or impossible case to someone else" such that the doctor's success rate stats will remain high and the outcome prediction stats would be unaffected (as the "trial" would go to another doctor).

I'm all for having more information available, and when my extended family faces a serious medical concern, we seek out friends and family in medicine, asking "if you faced this situation, what doctor would you trust?" I don't know of a way to globally institutionalize that process.

<comment><USER10> But the track record for such a doctor will clearly see that they aren't tackling the difficult cases. Would a doctor want a high success rate if it comes with a reputation for only taking easy cases?

Even if the answer to the above question is Yes, the reduced number of doctors willing to tackle difficult cases will be able to charge higher fees. So at some point you would reach a market equilibrium where the desire to tackle easy cases is balanced by the desire to earn a higher income. That is, when compared to the current system the easy cases will become cheaper and the more difficult cases will become more expensive - but maybe that is an acceptable outcome if it means the system as a whole is more efficient?

<comment><USER9> It depends on the goals of the doctor. If the doctor aspires to a massive volume of fixed-rate, "easy" procedures (look at cataract surgeons benefiting from the advances in that field while insurance and Medicare reimbursement rates remained constant [and high]). I'm not knocking those docs; they provided real and tangible benefits for millions of patients with cataracts and I don't begrudge them their money. It's just super amusing to me to walk down the multi-million dollar warbird parking area and have half the owners be eye doctors.

As for aspiring to have a reputation for efficacy in difficult cases and assuming that you'll be able to charge more due to market forces? I don't see that playing out in any Western medicine economy. IMO, you can't build a functional ecosystem around the very few patients who are self-paying and willing to pay large sums for better care.

Very wealthy individuals and pro sports teams are the only customers I can see for that. The overwhelming majority of people (far in excess of 99%) are going to have two hurdles to procure your expensive services. First, they have to find and select you. Second, they have to convince their insurance provider to pay your rate, instead of the "going rate". That seems uphill, probably steeply so.

<comment><USER10> (Sorry for delay - I just read your reply)

As someone who had a serious illness last year and who is not in the top 1%, I can promise you I would have crawled over broken glass if I thought it would have improved my chance of survival. I certainly would have paid a large chunk of my net worth to switch to a doctor who had a significantly better track record.

I don't understand why the medical insurance market wouldn't work. If the insurance company won't let me switch to a doctor who has a better track record, won't that insurance company get a bad reputation and lose business? U.S. doctors have a better reputation than Mexican doctors and in this case most people pay for insurance which covers treatment by the more reputable doctor - I imagine the same effect would apply between doctors within the US if there were a objective track record which identifies the better-performing doctors.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Why don't we? Because when it comes to health care we aren't rational. Emotions run and win the day. But not only do they win the day, they win the day in court for a lawsuit.

Ob-Gyns have some of the highest insurance rates among doctors. Possibly the highest. Why? Because they screw up it's a baby that dies. God help you if you think there's an ounce of rationality in a room with a dead baby.

Here's a similar article from earlier this year. The short version is that a man lost his wife to a mistake and... well that was it. The NHS (UK) doesn't do investigations as to what happened or why. That just means it will happen again. When a plane crashes there is a gigantic investigation and the results are shared. There are some famous cases where a series of basic mistakes needlessly lead to a crash and everyone dies. All pilots know about this so it doesn't happen anymore. Hospitals don't do that. Because it ends in pointing the blame finger. And then people lose their job, lose their license, and get the ever living shit sued out of them.

[http://www.newstatesman.com/2014/05/how-mistakes-can-save- li...](http://www.newstatesman.com/2014/05/how-mistakes-can-save-lives)

<comment><USER12> The difference with the airline industry is that when there is a crash everyone dies. If my father is dead, and his doctor who made the mistake is alive, you can imagine she is not going to volunteer the information.

<comment><USER13> This is only true if the cause is pilot error. If the cause is improper maintenance, the responsible party is still alive.

In the case of the NTSB, there is a strong culture of not penalizing errors unless they were criminal or egregious, which works well in promoting cooperation with the investigation. This would likely be very difficult to achieve with doctors, especially in the US.

</comment></comment></comment><comment><USER14> Perhaps would-be surgeons ought to have their manual coordination assessed _before_ they commence years of expensive training. The irony is that for my father's generation, in England, prowess on the rugby field was considered important in getting into medical school. (And that might actually have been a good thing. I suspect top athletes, musicians and surgeons all possess the same talent which would cease to be a 'talent' if only we could explain it.)

<comment><USER15> Right now the main criteria for medical school admission is simply how much information you can cram into your head and regurgitate. Critical thinking, thinking outside the box, dexterity, compassion...irrelevant.

</comment></comment><comment><USER16> I heard this first hand from Judah Folkman ([http://en.wikipedia.org/wiki/Judah_Folkman](http://en.wikipedia.org/wiki/Judah_Folkman)) at a seminar in 1999. He was discussing news reports that other labs were unable to reproduce the anti-cancer properties of certain proteins discovered by an MD in his lab.

He said (paraphrasing): Scientists become upset when other researchers cannot reproduce their results. Surgeons become upset when other surgeons _can_.

</comment><comment><USER17> I've been watching TCEC this week - the chess world championship for computers.

The joint #1 engine, Stockfish, has had a series of embarrassing losses to Gull, a much inferior engine. Everybody was convinced that Stockfish was surely broken because its level of play was so poor.

Then suddenly, in the last couple of days, it has turned itself around. After a series of wins it's only half a point off the top spot (if it draws the current game).

Here's the thing: _nothing changed_. It's the same code, the same algorithms, the same build. That bad run it had was just bad luck, there was never anything wrong with it.

An excess of information can absolutely be a force for ignorance. People will see patterns even when none exist. Often the only way to stop people from misinterpreting data is to not have any data at all.

If people can be so easily mislead by the fortunes of an unchangingly consistent algorithm, just think how destructive data on surgeons could be.

<comment><USER18> question: bad luck in chess? I do not get it. Maybe I'm simplifying, but the program which gets deeper in the movement tree, should always win.

<comment><USER19> > but the program which gets deeper in the movement tree, should always win

It doesn't always work like that. Usually, since examining, the whole move tree is very expensive, heuristics tend to kick in at various points providing assessments for positions (thus helping to prune the tree). It is quite possible to land in a position where your set of heuristics is not quite right.

</comment></comment></comment><comment><USER20> The ideas presented here seem pretty sensible. However, there is a risk that if such data is collected, it may later be used to compare surgeons to each other. One of the reasons that is risky is that good surgeons tend to deliberately take on more complex and riskier operations than those less capable, and therefore have statistically worse outcomes. There can also be geographical biases if statistics are summarised, such as certain hospitals having poor outcomes because they happen to get a lot of gunshot wounds, or stabbings, or the local population is older than average, or childbirth rates are higher, etc. It would difficult to control for all possible such variables, and ever more difficult to explain the methodology to the public.

It's probably a universally good idea as long as there are safeguards to ensure that the data is not shared generally, which might lead to misinformed reactions and subsequently, target-chasing (see: Goodhart's law). Using the data purely for personal improvement seems like it should be effective. I think it's reasonable to assume that most surgeons would want to self-improve if they can. Also surgeons tend to be especially competitive, so creating a competition against themselves could be a good motivator in itself.

The data could perhaps be used to weed out poorly performing surgeons too. I believe the right way to do that would be to share the data anonymously with peers who are able to interpret it properly. These peers could then flag any worrying anomalies in the data that can't be explained away, which should trigger a follow-up investigation of the individual concerned. This could perhaps stop the next Harold Shipman, as well as weeding out incompetence.

Of course, it may not be possible to usefully anonymise case data since some of the more complex cases may be sufficiently unique that the surgeon could be personally identified from the description. This would only work if case can be classified broadly enough to avoid personal identification and narrowly enough to provide enough information for peer review.

<comment><USER21> As the case of Dr. Christopher Duntsch revealed, the limiting factor in these things isn't that other surgeons noticed an incredible lack of skill (because they did), but the nature of the problem requires a great deal of time before the board involved can collect sufficient evidence of incompetence to the degree of negligence. It looks like this sort of thing would still help, but you'd still need to determine that the surgeries themselves were done ineptly.

</comment></comment><comment><USER22> Developers could learn from this. I've a few grey hairs, many caused by late nights coding, and I now run a dev team. I wonder if we could really learn from this - for example, looking at the 3rd video in the youtube playlist from the article, looking at the criteria they judge each other on, let's see how transferable they are:

\- minimal movement: using clear, concise code, or few commands, to solve a problem

\- lack of repeated actions: exactly that. Why did I just look at that same log file 5 times?

\- confident use of tools: do I have a set of tools (IDEs, editors, commands) I know intimately?

\- awkwardness of actions: can I think several steps ahead in the problem and bring things into line to form the solution?

And so on. This is a raw, unrefined thought and I hope it gets thoroughly pulled apart in any replies.

<comment><USER23> I think this would lose some practicality when put into practice. Clumsy, awkward code may still offer great business value/ Brilliant, precise code, when misapplied to its purpose, can still fail. Of course, everyone wants good code... but I do not think the direct correlation of quality to outcomes from surgery would exist in the coding world.

<comment><USER24> Maybe it's sufficient to ask: what would be useful for developers to keep score of in order to improve professionally?

Surgeons keep score by measuring patient outcomes in order to draw conclusions about their own performance, the effect of which is to "shrink the outliers" \- people see where they can improve and they go ask their colleagues, "hey, how'd you do that?". So what would the equivalent of that be for a developer?

The best tool I can think of for this isn't an automated system for scorekeeping - it's soliciting feedback [1]. You ask a more seasoned dev who is familiar with your work where you can improve.

How do you "shrink the outliers" on a team of developers? Get people to work together. Take each other's code apart.

[1] Particularly negative feedback, according to Elon Musk at the end of this vid: [http://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spa...](http://www.ted.com/talks/elon_musk_the_mind_behind_tesla_spacex_solarcity)

</comment></comment></comment><comment><USER25> This doesn't solve the information asymmetry (and I don't really think you can solve the information asymmetry short of getting an MD yourself). What it does is abstract it behind tables of scores but at the end of the day, the patient still needs to trust that the system is logical and that the compiled data is accurate and then somehow bridge the generalized case of the compiled data to his own case which is probably the trickiest part for somebody without medical training.

Maybe you should just trust your GP on this one. Or if you think you cannot, maybe find a healthcare system that aligns the incentives of your GP with your well-being.

</comment><comment><USER26> A big problem with scoring systems is that it incentivises risk taking. If you enter one of the stock picking competitions, for example, you rational choice is to take extreme risks.

You probably won't pick a winning stock, but if you do you're likely to have a good chance at winning the competition. This is the opposite of what an investor wants to do with his own money, which is to manage the risk taking.

This is a common problem in designing scoring systems for measuring performance, even after the more ovious problems with natural variations.

<comment><USER27> That's true of stock picking competitions/tournament-style gambling, yes, but it wouldn't apply here.

If I'm a surgeon with a good score, I make bad judgements and they start coming off poorly, I won't have a good score any more. Am I motivated to take a bad risk? Not unless I have some other reason to.

<comment><USER26> It's not directly applicable because it is a different problem domain, but the general reasoning holds. The problem is that the optimum strategy for maximizing your score is not to be as good a surgeon as possible.

(Which I stupidly say without having the slighest idea how this works beyond what is described in the article. But I have yet to see a scoring system which aligns where the optimum strategy aligns perfectly with the desired outcome, and this holds for everything from grades in school to karma systems.)

<comment><USER27> No: the general reasoning doesn't hold.

The reasoning for tournaments is that you have to be first at all cost, so you should consider taking the largest risk available to avoid coming second. That reasoning doesn't hold for surgeons: there's room for more than one surgeon.

There are problems with scoring systems, yes, but a complete lack of information for consumers is considered terrible in any other industry.

</comment></comment></comment></comment><comment><USER28> Here's a study of hospital report cards that shows a decrease in patient welfare from the increased transparency. As others in this thread have noted, the report cards led to doctors not wanting to take on risky patient.

[http://www.kellogg.northwestern.edu/faculty/satterthwaite/re...](http://www.kellogg.northwestern.edu/faculty/satterthwaite/research/2003-0520%20dranove%20et%20al%20re%20report%20cards%20%28jpe%29.pdf)

<comment><USER29> This article mentions this problem and addresses it towards the end of the article. The key part of addressing the problem is confidentiality. Interestingly know of another piece of software which is being developed with the aim of reducing inappropriate dosagages during medical care. It works a similar way and uses anonymous comparison as well.

</comment></comment><comment><USER30> Like anything in life the devil is in the details. What measures and metrics could possibly be used to determine the score? If you go by mortality rates alone you risk creating an environment where no one wants to operate on the most at risk patients. You'll quickly find that the best surgeons aren't necessarily the most surgically skilled, but instead those who do the best job of pre-screening surgical candidates. If this continues, soon you'll have patients whom doctors flat out refuse to cut open. If instead of mortality rates, you score the doctors on skill of movement in their procedures, again, you'll find doctors gaming the system by picking healthier patients with lower body fat percentages.

Fundamentally, if a system was in place to score surgeons a lot of checks and balances would need to be enacted to avoid lowering the quality of care by ensuring doctors, hospital staff, and administrators couldn't simply pick and choose what surgeon gets what patient. I really see this as a neat data science project after the fact, but if implemented could have a significant downside impact on patient outcomes for some.

<comment><USER31> Well, the solution proposed in the article is to keep the scores hidden from everyone but the particular surgeon. That is, have the score be a motivator and guide for personal improvement rather than an external quality indicator. They report on trials where similar scores were published in NY and the end result was that the highest risk patients got shipped off to Ohio, exactly as you describe. So it's critical that the data is not shown to anyone but the surgeon in question.

<comment><USER30> The problem is that by keeping it hidden from everyone but the surgeon and by still allowing the surgeon to have a say in who they operate on, they can still game the system. There are no external controls at that point. Now if it's only for their benefit what possible reason would a surgeon have to game the score you might ask?

You can provide all the assurances in the world that the score is a personal motivator, but we all know that could change at the drop of the hat. I've seen this far too often in the security field. Someone will come up with a great measure, will reassure everyone that all unintended consequences have been considered and then boom. A year down the line an executive, unaware of the ramifications of unintended consequences will want to use the metric for performance evaluations. I think any surgeon who believes the score is only there to help them and that they shouldn't plan for a future where someone pushes to make it more public is being a bit naive in the ways of the world.

This isn't to say I don't think there could be a solution. The scoring system needs to be built from the ground up with an offset risk equation which provides significant incentive to operate on at risk patients. Maybe a surgeon gets three points for operating on the patient and if they die they only loose one. However if they have a healthy patient maybe they start off with one point, with just one to loose. Obviously all the unintended consequences for this model would need to be explored at length.

<comment><USER32> "There are no external controls at that point."

Well... there appear to be no external controls at _this_ point, either...

<comment><USER33> Right. Even in the current situation, surely there is _some_ incentive for surgeons to turn down high-risk patients, because of the inevitable stress and potential legal trouble from a failed operation.

</comment></comment></comment></comment></comment><comment><USER34> Measuring the quality of surgeons is like measuring the quality of policemen or firemen or lawyers or politicians. It just isn't done.

And even if it could be done - how are you going to enforce quality once you measure it? By suspending the bottom 20%? There is already a shortage of surgeons. And surgeons are paid poorly for their work and their investment in education. You cannot pay the better ones more-It is not a free market- prices are fixed by government decree. And physician reimbursement is ONLY tied to work volume (Relative Value Units billed) Frankly, I would be scared to be a patient in the US now; cannon fodder in war of the medical industrial complex versus the third party payers. Insurors would rather pay multimillion dollar salaries to executives and hospital CEOs instead of a quality assurance program. Incentives are aligned to maximize profit, which constantly and carefully measured. Shareholder return is the single most important metric of a publicly held company like Blue Cross, United Health Care, etc. Quality is a pass/fail grade based on outdated measures designed to be politically correct.

</comment><comment><USER35> I would like to give my 2 cents to the discussion, as a Medical Doc who was training to become an Orthopedic Surgeon.

One of the problems with Surgical Branches is that beyond a certain point (i.e: Beyond from knowing how to do a procedure) the act of performing a surgery essentially is an art form (Skill). I learned the same from one of the leading Orthopedic Surgeons in India. And that is one of the crucial most factors that differentiates Good surgeon from a Bad One.

Although skill can NOT be quantified but certainly in the case of Surgery we can quantify the results of the skills in terms of complications of surgery, recovery and patient satisfaction.

One solution to the problem would be :

(A) To have a feedback mechanism for doctors. Where they receive a score on their performance and can compare if to other surgeons performing similar procedures.

The surgeon would upload a video of all the types of procedures they do every 3 months. And just like NEJM a committee of people provide inputs and rating on the skills of the surgeon. This score in combination with the complication rate and patient feedback would go into making the overall score of the doctor. The doctor will be able to see where he stand in compare to their colleagues from across the country (possible the world). And also for newer (or BAD) surgeons this system would provide a way to learn from the best in the field and improve their skills.

(B) If you try to make such a score Public initially, it will receive a huge backslash from the doctors and the industry. But having an internal score keeping mechanism is much better than having no score / rating system.

(C) Some hospitals actually do have internal metrics where they track surgeon's performance. In terms of complication rate and other metrics -- but this data is RARELY available to the public.

(D) Unless some kind of law is passed at a Federal level in the US, I am not very optimistic about the situation improving.

</comment><comment><USER36> Measuring surgeon performance directly is both very difficult and unlikely to do what you want: increase your chances of living through a surgery.

BUT, surgeons do not perform in a vacuum. There are a number of things you can measure and get usable information.

You can measure the number of surgeries of the kind you are getting performed by your surgeon vs. by practices specializing in such procedures. You will almost always find that the more a surgeon does a procedure, the better the outcomes.

You can measure re-admissions after surgery. You can measure infection rates. Etc. These will tell you the quality of the hospital where the surgery will be performed.

</comment><comment><USER37> After watching the videos, my answer is YES.

If a bad programmer is 10x slower, experience with a bad surgeon make 10x more likely to die, have complications, undergo reoperation, and be readmitted after hospital discharge.

<comment><USER38> Honestly, rating surgeons is probably much more difficult than rating programmers.

<comment><USER39> Not so sure about that, these surgeons are performing the same procedure again and again. And being compared to surgeons who also perform the same procedure.

We don't tend to write the exact same code repeatedly. Or the exact same code as other coders.

<comment><USER20> I suppose it is just like writing exactly the same app over and over again. But in a different Lisp dialect every time. And several of the system libraries are missing, but you never know which ones until you try running the code.

</comment></comment></comment></comment><comment><USER40> I like this paragraph of the article best (but there are a lot of other good paragraphs, building to an overall good whole, so I encourage you to read the whole article): "In Better, Atul Gawande argues that when we think of improving medicine, we always imagine making new advances, discovering the gene responsible for a disease, and so on — and forget that we can simply take what we already know how to do, and figure out how to do it better. In a word, iterate." That's exactly it. Medicine improves most dramatically simply by spreading the word about how to prevent and how to treat illnesses better to everyone who hasn't mastered that yet. That's the biggest single factor in steadily reducing death rates at all ages all over the developing world.[1]

The one time I had an immediate family member who needed treatment for a puzzling disease, my mom was still working as a surgical nurse in our state's main research university's teaching hospital. She knew who the best surgeon was, who the best surgical resident was, who the best anesthesiologist was, and who the best surgical nurses were. My relative was able to recover fully very soon after surgery that THAT surgeon thought had "nil" risk--he was confident of his abilities, with justification. Now that my mom is not in active practice of nursing anymore, I would like a better consumer-facing channel for information about which surgeons are the best in town. I would definitely ask the nurses I know who work at teaching hospitals if the question came up again for my family.

[1] An article in a series on Slate, "Why Are You Not Dead Yet? Life expectancy doubled in past 150 years. Here's why"[3] Provides some of the background.

[http://www.slate.com/articles/health_and_science/science_of_...](http://www.slate.com/articles/health_and_science/science_of_longevity/2013/09/life_expectancy_history_public_health_and_medical_advances_that_lead_to.html)

Life expectancy at age 40, at age 60, and at even higher ages is still rising throughout the developed countries of the world.[4]

[http://www.nature.com/scientificamerican/journal/v307/n3/box...](http://www.nature.com/scientificamerican/journal/v307/n3/box/scientificamerican0912-54_BX1.html)

</comment><comment><USER41> This is worth reading, to develop your software engineering skills.

[http://www.amazon.com/Introduction-Personal-Software- Process...](http://www.amazon.com/Introduction-Personal-Software-Process- Humphrey/dp/0201548097/ref=sr_1_5?s=books&ie=UTF8&qid=1418563485&sr=1-5&keywords=engineering+watts+humphrey)

</comment><comment><USER42> Here's an interesting story of medical open data and highly improving medical procedures: [http://www.newyorker.com/magazine/2004/12/06/the-bell- curve](http://www.newyorker.com/magazine/2004/12/06/the-bell-curve)

</comment><comment><USER43> [http://blogs.law.harvard.edu/abinazir/2005/05/23/why-you- sho...](http://blogs.law.harvard.edu/abinazir/2005/05/23/why-you-should-not- go-to-medical-school-a-gleefully-biased-rant/)

</comment><comment><USER44> "You can think of surgery as not really that different than golf." ... The difference is that golfers keep score.

No Golfer don't think they are God.

</comment><comment><USER10> This article reminds me of Bill Gate's emphasis on measuring outcomes - here's a quote from the Gates Foundation 2013 letter [1]:

\</comment><comment></comment><comment>-- Begin Gates Quote </comment><comment></comment><comment>---

 _Over the holidays I read The Most Powerful Idea in the World, a brilliant chronicle by William Rosen of the many innovations it took to harness steam power. Among the most important were a new way to measure the energy output of engines and a micrometer dubbed the "Lord Chancellor," able to gauge tiny distances.

Such measuring tools, Rosen writes, allowed inventors to see if their incremental design changes led to the improvements-higher-quality parts, better performance, and less coal consumption-needed to build better engines. Innovations in steam power demonstrate a larger lesson: Without feedback from precise measurement, Rosen writes, invention is "doomed to be rare and erratic." With it, invention becomes "commonplace."

Starting around 1805, the "Lord Chancellor" micrometer, according to author William Rosen, was "an Excalibur of measurement, slaying the dragon of imprecision," for inventors in the Industrial Revolution. (© Science Museum, London) Of course, the work of our foundation is a world away from the making of steam engines. But in the past year I have been struck again and again by how important measurement is to improving the human condition. You can achieve amazing progress if you set a clear goal and find a measure that will drive progress toward that goal-in a feedback loop similar to the one Rosen describes. This may seem pretty basic, but it is amazing to me how often it is not done and how hard it is to get right._

\</comment><comment></comment><comment>-- End Gates Quote </comment><comment></comment><comment>---

Nobody questions the need for measurement in engineering, but when Mr Gates tried to apply the same logic to measuring teacher effectiveness [2] he received a lot of pushback from people who say his method is flawed [3,4] or simply that teaching effectiveness cannot be reliably measured.

This is a controversial topic. Here is an interesting take on this subject from a book called Teaching as Leadership [5]:

\</comment><comment></comment><comment>-- Begin Teaching as Leadership Quote </comment><comment>-----

 _As we see modeled by these teachers, the less tangible nature of such longer term dispositions, mindsets, and skills does not mean they cannot be tracked and, in some sense, measured. In fact, if these ideas are going to be infused into a big goal, you must have a way to know that you are making progress toward them.

Mekia Love, a nationally recognized reading teacher in Washington, D.C., sets individualized, quantifiable literacy goals for each of her students but also frames them in her broader vision of "creating lifelong readers." This is a trait she believes is a key to her students opportunities and fulfillment in life. In order for both Ms. Love and her students to track their progress toward creating lifelong readers, Ms. Love developed a system of specific and objective indicators (like students self-driven requests for books, students' own explanations of their interest in reading, the time students are engaged with a book.) By setting specific quantifiable targets for and monitoring each of those indicators, she was able to demonstrate progress and success on what would otherwise be a subjective notion.

Strong teachers -- because they know that transparency and tracking progress add focus and urgency to their and their students efforts -- find a way to make aims like self-esteem, writing skills, "love of reading," or "access to high-performing high schools" specific and objective. These teachers -- like Ms. Love, Mr. Delhagen, and Ms. Jones -- ask themselves what concrete indicators of resilience or independence or "love of learning" they want to see in their students by the end of the year and work them into their big goals.

In our experience, less effective teachers may sometimes assume that because a measurement system may be imperfect or difficult, then it must be wrong or impossible. As Jim Collins reminds us in his studies of effective for profit and nonprofit organizations:

"To throw our hands up and say, But we cannot measure performance in the social sectors the way you can in a business is simply lack of discipline. All indicators are flawed, whether qualitative or quantitative. Test scores are flawed, mammograms are flawed, crime data are flawed, customer service data are flawed, patient outcome data are flawed. What matters is not finding the perfect indicator, but settling upon a consistent and intelligent method of assessing your output results, and then tracking your trajectory with rigor."_

\</comment><comment></comment><comment>-- End Teaching as Leadership Quote </comment><comment>-----

Lastly, on a personal note I have found that I simply cannot lose weight unless I keep track of the number of calories I eat. There is something about seeing that number that has a strong influence over my behaviour.

\</comment><comment></comment><comment>-- References </comment><comment></comment><comment>--

[1] [http://www.gatesfoundation.org/Who-We-Are/Resources-and- Medi...](http://www.gatesfoundation.org/Who-We-Are/Resources-and-Media/Annual- Letters-List/Annual-Letter-2013)

[2] [http://www.metproject.org/](http://www.metproject.org/)

[3] [http://jaypgreene.com/2013/01/09/understanding-the-gates- fou...](http://jaypgreene.com/2013/01/09/understanding-the-gates-foundations- measuring-effective-teachers-project/)

[4] [http://garyrubinstein.teachforus.org/2013/01/09/the-50-milli...](http://garyrubinstein.teachforus.org/2013/01/09/the-50-million- dollar-lie/)

[5] [http://www.amazon.com/Teaching-As-Leadership-Effective- Achie...](http://www.amazon.com/Teaching-As-Leadership-Effective- Achievement/dp/0470432861)

</comment><comment><USER45> Surgeons, at least in first-world countries, and not only there, already operate on a skill level which is hard to measure at all.

In procedures where there is a high probability of success, many surgeons would need to collect data points for years to even reliably tell they are better or worse than a particular other doctor.

Very challenging, statistically...

<comment><USER46> The whole point of the article is that surgeon ability can be reliably determined from looking at short videos, and this ability is correlated with how well the patient does.

For another interesting article on this, see [http://well.blogs.nytimes.com/2013/10/31/a-vital-measure- you...](http://well.blogs.nytimes.com/2013/10/31/a-vital-measure-your- surgeons-skill/?_r=0)

<comment><USER47> And not only that, by ten-year-old daughters, too!

</comment></comment></comment><comment><USER48> Hm, this article reads like kind of a puff piece for Amplio.

> similar efforts to "grade" American schoolteachers, for instance, have > perhaps generated more controversy than results.

Yes, for good reasons, namely...

> It's all about trust.

No, it's not. At all. The author even notes the problem with scoring systems, that happened in _this exact field_. When you start scoring people, they start gaming the system to increase that score. It's the same problem with "grading teachers". You give surgeons huge incentives to start "fudging the truth" about their patients' surgical risk.

"Oh blah blah blah it's private". Great. Hopefully everyone involved can see the obvious future problems (which 7 comments in, other HN posters have zeroed in on), but they haven't given any assurances that these fears will never come to fruition. Or any prevention plans.

> It's like Vickers said to me one night in early November, as we were > discussing Amplio, "Having been in health research for twenty years, there's > always that great quote of Martin Luther King: The arc of history is long, > but it bends towards justice."

I actually laughed when I read this. How pretentious.</comment>